Summaries are AI-assisted and may contain errors — always read the original. We link to every source and never republish full articles.
PrivacySignal Actionable intelligence for privacy, AI governance & digital regulation
● Live
Kennedys Law LLP: AI regulation: The EU–US sovereignty contest CyberScoop: Spyware attacks trend toward hitting just about anyone WIRED — AI: The AI Safety Debate Has Lost the Plot. We Asked 10 Experts What the Real Nightmares Are Reuters: PODCAST: Oil's well that ends well BleepingComputer: Fireworks AI discloses new breach after cloud provider hack The Guardian — Tech: Australia to introduce mandatory reporting after OpenAI hack to combat artificial intelligence ‘going rogue’ BBC — Tech: Australia considers criminal penalties for rogue AI in wake of OpenAI hack EFF — Deeplinks: We’re Asking an Appeals Court to Require a Warrant for ALPR Searches Inside Privacy (Covington): Pennsylvania Enacts Artificial Intelligence Deceptive Advertising Act Nextgov/FCW: The ears have it in NIST’s facial recognition research The Record: Data breach at hearing aid giant Amplifon impacts thousands DataBreaches.net: Binance calls alleged “ShinyHunters” post a scam attempt IAPP: CalPrivacy Board advances rulemaking to update opt-out preference signals requirements HIPAA Journal: Healthcare Providers Discover Unauthorized PHI Disclosures to AI Tools Politico — Tech: Inside Democrats’ 2028 brainstorm on AI safety Schneier on Security: AI Security NPR — Tech: Why a South Korean city is turning to a U.S. college to outsmart AI? Microsoft Threat Intelligence: ARTEX abuse expands as cybercriminals target financial sector Ars Technica — Policy: “Does Meta think we can’t read?” Meta abandons sketchy commercial terms update. SCOTUSblog: DOJ steps up its investigation into the Dobbs leak New York Times — Tech: Microsoft’s Buyout Offer Sets Its Workforce on Edge War on the Rocks: Can Washington and China Build Confidence Around AI and Stability? Privacy Commissioner of Canada: News release: Completed 2025-2026 Contributions Program projects reveal insights related to personal information collection by smart devices Military Times: Shield AI to acquire radar maker Echodyne to bust drones Lawfare: Scaling Sovereign Wealth: Evaluating Mechanisms for the U.S. Government to Own Parts of AI Companies Just Security: Germany’s Proposed Hack-Back Powers and Outsourced Surveillance Are Testing Constitutional Limits EDPS: New episode of Newsletter Digest Education Times: West Bengal schools to introduce AI facial recognition attendance: Teachers may no longer need to call student's names as 100 schools prepare for trial CyberScoop: Russian Turla group used new toolset to silently pilfer emails from Kazakhstan, Romanian governments WIRED — AI: Tear Down Those Guardrails! Meet the Renegades Freeing Chatbots From Corporate Enslavers Reuters: Energy security push could lower emissions, Wood Mackenzie says BleepingComputer: Vanderbilt University hit in BYOD ransomware attack, data theft claimed The Guardian — Tech: Mandatory AI safety and security protections announced after OpenAI breach of Medicare – video BBC — Tech: Qantas to outsource 850 local jobs with most roles moving to India EFF — Deeplinks: Google Forcing AI on Students Is BS Nextgov/FCW: Deloitte wins $488M FAA modernization challenge contract The Record: Alleged AI-aided cyberattack exploits assistant interface to breach German web host DataBreaches.net: Weill Cornell patient data entered into AI tools without authorization IAPP: Thought for the week: Companies face cyber pain as hackers press AI advantage HIPAA Journal: PJ&A to Pay Up to $10 Million to Resolve Violations of HIPAA; State Law Kennedys Law LLP: AI regulation: The EU–US sovereignty contest CyberScoop: Spyware attacks trend toward hitting just about anyone WIRED — AI: The AI Safety Debate Has Lost the Plot. We Asked 10 Experts What the Real Nightmares Are Reuters: PODCAST: Oil's well that ends well BleepingComputer: Fireworks AI discloses new breach after cloud provider hack The Guardian — Tech: Australia to introduce mandatory reporting after OpenAI hack to combat artificial intelligence ‘going rogue’ BBC — Tech: Australia considers criminal penalties for rogue AI in wake of OpenAI hack EFF — Deeplinks: We’re Asking an Appeals Court to Require a Warrant for ALPR Searches Inside Privacy (Covington): Pennsylvania Enacts Artificial Intelligence Deceptive Advertising Act Nextgov/FCW: The ears have it in NIST’s facial recognition research The Record: Data breach at hearing aid giant Amplifon impacts thousands DataBreaches.net: Binance calls alleged “ShinyHunters” post a scam attempt IAPP: CalPrivacy Board advances rulemaking to update opt-out preference signals requirements HIPAA Journal: Healthcare Providers Discover Unauthorized PHI Disclosures to AI Tools Politico — Tech: Inside Democrats’ 2028 brainstorm on AI safety Schneier on Security: AI Security NPR — Tech: Why a South Korean city is turning to a U.S. college to outsmart AI? Microsoft Threat Intelligence: ARTEX abuse expands as cybercriminals target financial sector Ars Technica — Policy: “Does Meta think we can’t read?” Meta abandons sketchy commercial terms update. SCOTUSblog: DOJ steps up its investigation into the Dobbs leak New York Times — Tech: Microsoft’s Buyout Offer Sets Its Workforce on Edge War on the Rocks: Can Washington and China Build Confidence Around AI and Stability? Privacy Commissioner of Canada: News release: Completed 2025-2026 Contributions Program projects reveal insights related to personal information collection by smart devices Military Times: Shield AI to acquire radar maker Echodyne to bust drones Lawfare: Scaling Sovereign Wealth: Evaluating Mechanisms for the U.S. Government to Own Parts of AI Companies Just Security: Germany’s Proposed Hack-Back Powers and Outsourced Surveillance Are Testing Constitutional Limits EDPS: New episode of Newsletter Digest Education Times: West Bengal schools to introduce AI facial recognition attendance: Teachers may no longer need to call student's names as 100 schools prepare for trial CyberScoop: Russian Turla group used new toolset to silently pilfer emails from Kazakhstan, Romanian governments WIRED — AI: Tear Down Those Guardrails! Meet the Renegades Freeing Chatbots From Corporate Enslavers Reuters: Energy security push could lower emissions, Wood Mackenzie says BleepingComputer: Vanderbilt University hit in BYOD ransomware attack, data theft claimed The Guardian — Tech: Mandatory AI safety and security protections announced after OpenAI breach of Medicare – video BBC — Tech: Qantas to outsource 850 local jobs with most roles moving to India EFF — Deeplinks: Google Forcing AI on Students Is BS Nextgov/FCW: Deloitte wins $488M FAA modernization challenge contract The Record: Alleged AI-aided cyberattack exploits assistant interface to breach German web host DataBreaches.net: Weill Cornell patient data entered into AI tools without authorization IAPP: Thought for the week: Companies face cyber pain as hackers press AI advantage HIPAA Journal: PJ&A to Pay Up to $10 Million to Resolve Violations of HIPAA; State Law

Top Stories

Breach
The Guardian — Tech · · International

Australia to introduce mandatory reporting after OpenAI hack to combat artificial intelligence ‘going rogue’

Australia's government is moving to change criminal law to require mandatory reporting of AI-related data breaches, following a June breach of a Medicare statistics portal linked to OpenAI. The prime minister signaled the reforms are designed to close loopholes that could allow companies to claim ignorance when AI systems cause harm.

Who should care: Cybersecurity · Privacy officers · Administrators · Lawyers · Compliance · AI governance · General readers · Policy #breach#enforcement#ai-governance#ai Read original →

Analysis

All analysis →

Weekly Editorial Analysis from Experts and Editors

Logged Is Not Authorized

Georgia law restricts police use of license plate data to law enforcement purposes. A new lawsuit alleges deputies searched a man's vehicle five times while he was suing their sheriff. Two recorded reasons were "info" and "37." The system accepted both.

A reason nobody checks is not a control. It is a formality.

The Signal Desk · · 6 min read Read →
Deep Signal · Part I of III

The Algorithm Said So

Federal rulemakers are deciding what to do when artificial intelligence produces the kind of conclusion that once required an expert. They disagree about how to regulate it. They also disagree about whether the problem has arrived.

· 10 min read Read →

Surveillance & Civil Liberties

News
EFF — Deeplinks · · International

We’re Asking an Appeals Court to Require a Warrant for ALPR Searches

The EFF and ACLU filed a joint amicus brief in the Sixth Circuit, arguing that police use of automated license plate reader data to track a suspect's movements without a warrant constitutes a search under the Fourth Amendment. The case stems from a robbery investigation in the Cleveland area where law enforcement accessed ALPR records with no warrant.

Who should care: Privacy officers · Cybersecurity · General readers · Policy

#surveillance#privacy Read original →
Breach
U ukmalayalee · · International

UK Plans Facial Recognition Surveillance to Identify Migrants Who Overstay Visas and Breach Immigration Rules

The UK government is planning to use facial recognition surveillance as a tool to identify migrants who have overstayed visas or otherwise violated immigration rules. The proposal would expand biometric monitoring as part of immigration enforcement.

Who should care: Cybersecurity · Privacy officers · Administrators · Lawyers · Compliance · General readers · Policy

#breach#regulation#surveillance#privacy Read original →
Enforcement
R Reuters · · International

Axon sued over AI-powered license plate reader network

Axon, the law enforcement technology company, is facing a lawsuit over its AI-powered license plate reader network. The suit challenges the company's system, which captures and processes vehicle location data at scale.

Who should care: Lawyers · Privacy officers · Compliance · Cybersecurity · General readers · AI governance · Policy

#enforcement#surveillance#ai Read original →
News
Nextgov/FCW · · US Federal

The ears have it in NIST’s facial recognition research

New NIST research on facial recognition finds that trained forensic examiners can identify individuals from just one or two facial features, with the ear emerging as a preferred starting point rather than the eyes.

Who should care: Privacy officers · Cybersecurity · General readers · Policy

#surveillance#privacy Read original →
Breach
TechCrunch — Privacy · · International

New York City’s Mamdani criticizes Madison Square Garden owner over surveillance tech

New York City Mayor Zohran Mamdani has publicly criticized the owner of Madison Square Garden over the company's use of surveillance technology. His remarks follow a data breach last year that exposed details of how James Dolan's organization conducts surveillance.

Who should care: Cybersecurity · Privacy officers · Administrators · General readers · Policy

#breach#surveillance#privacy Read original →
Enforcement
EPIC · · US Federal

USA Today: Can you sue over targeted ads? ‘Blockbuster’ Supreme Court case to decide

The Supreme Court is set to decide whether individuals can sue over targeted advertising tied to their video viewing habits, in a case that could test the reach of the Video Privacy Protection Act. The outcome may determine whether existing federal law can fill gaps left by the absence of comprehensive U.S. privacy legislation.

Who should care: Lawyers · Privacy officers · Compliance · Cybersecurity · General readers · Policy

#enforcement#state-privacy#surveillance#privacy Read original →
Enforcement
noyb (None of Your Business) · · EU

noyb win: French electronics retailer Fnac Darty fined €7 million

France's data protection authority fined electronics retailer Fnac Darty €7 million for running third-party trackers on its mobile app without user consent. The penalty follows a 2023 complaint filed by privacy advocacy group noyb.

Who should care: Lawyers · Privacy officers · Compliance · AI governance · Cybersecurity · General readers · Policy

#enforcement#gdpr#surveillance#privacy Read original →
News
Just Security · · US Federal

Germany’s Proposed Hack-Back Powers and Outsourced Surveillance Are Testing Constitutional Limits

Germany is considering legislation that would expand intelligence agency powers to include offensive cyber operations and outsourced surveillance functions. Critics argue the reforms could allow security services to operate with less oversight and more secrecy than constitutional protections are designed to allow.

Who should care: Privacy officers · Cybersecurity · General readers · Policy

#surveillance#privacy Read original →
Enforcement
The Record · · International

European digital rights nonprofit noyb sues Scale AI for ‘invasive’ worker surveillance

European privacy nonprofit noyb has filed a lawsuit against Scale AI, alleging the company subjects freelance workers to invasive monitoring that can include logging mouse clicks and keystrokes every few seconds and generating video records of their entire workday.

Who should care: Lawyers · Privacy officers · Compliance · Cybersecurity · General readers · AI governance · Policy

#enforcement#surveillance#ai#privacy Read original →
News
CyberScoop · · US Federal

Spyware attacks trend toward hitting just about anyone

iVerify’s report Tuesday adds to evidence of spyware’s increasingly indiscriminate targeting. The post Spyware attacks trend toward hitting just about anyone appeared first on CyberScoop.

Who should care: Privacy officers · Cybersecurity

#surveillance Read original →
News
The Guardian — Privacy · · International

‘Digital hostile environment’: AI secretly being embedded across Home Office, report claims

A report by the Open Rights Group finds that AI has been quietly embedded across the UK Home Office, covering immigration enforcement tasks such as age determination for asylum seekers, sham marriage detection, and phone content review. The deployment has occurred with little public disclosure.

Who should care: Privacy officers · Cybersecurity · General readers · AI governance · Policy

#surveillance#ai#privacy Read original →

Privacy Under the Radar

Enforcement
EFF — Deeplinks · · International

We’re Asking the Ninth Circuit to Hold Reverse Location Warrants Categorically Unconstitutional

The EFF and ACLU have filed an amicus brief in the Ninth Circuit asking the court to rule that 'tower dump' warrants — which force carriers to hand over location data for every phone in a given area — are categorically unconstitutional under the Fourth Amendment. The case follows a Supreme Court ruling this summer that geofence warrants constitute searches under the Fourth Amendment.

Who should care: Lawyers · Privacy officers · Compliance · Cybersecurity · General readers · Policy

#enforcement#surveillance#privacy Read original →
News
E Education Times · · International

West Bengal schools to introduce AI facial recognition attendance: Teachers may no longer need to call student's names as 100 schools prepare for trial

West Bengal is preparing to trial AI-powered facial recognition systems for tracking student attendance in 100 schools, replacing traditional roll calls by teachers.

Who should care: Privacy officers · Cybersecurity · General readers · AI governance · Policy

#surveillance#ai#privacy Read original →
Enforcement
R Reuters · · International

Indonesian police say wiretapping probe a matter for law enforcement, as parliament considers inquiry into VP

Indonesian police have asserted that an investigation into alleged wiretapping falls under law enforcement jurisdiction, while parliament separately weighs launching an inquiry into the vice president. The two proceedings appear to be running on parallel tracks within Indonesia's political and legal institutions.

Who should care: Lawyers · Privacy officers · Compliance · Cybersecurity

#enforcement#surveillance Read original →
Enforcement
EPIC · · US Federal

Utah Public Radio: Vermont is home to two of ICE’s surveillance facilities. Locals are pushing back

Vermont residents are raising concerns about two ICE surveillance facilities operating in the state. A privacy attorney with the Electronic Privacy Information Center warns that recent congressional funding has made ICE the most heavily funded federal law enforcement agency, with analysts potentially targeting people based on anti-ICE views.

Who should care: Lawyers · Privacy officers · Compliance · Cybersecurity · General readers · Policy

#enforcement#surveillance#privacy Read original →
News
Nextgov/FCW · · US Federal

What the midterm results mean for federal tech policy

A shift in congressional control following the midterm elections is expected to bring increased legislative scrutiny to federal technology policy, covering areas such as IT management, government workforce, cybersecurity, and data infrastructure.

Who should care: Privacy officers · Cybersecurity · General readers · Policy

#surveillance#privacy Read original →
News
Just Security · · US Federal

Series: Comparing National Trends in Cyber and Surveillance Expansion

The Atlantic Council and Just Security have launched a joint series examining how governments around the world are expanding their cyber and surveillance powers, comparing trends across different national contexts.

Who should care: Privacy officers · Cybersecurity · General readers · Policy

#surveillance#privacy Read original →

AI Under the Radar

AI Governance
WIRED — AI · · International

The Biggest Pro-AI Super PAC Network Didn’t Really Impact the Midterms

Leading the Future, a super PAC funded by major Silicon Valley billionaires with $100 million aimed at opposing AI regulation, saw little electoral payoff from its spending in Tuesday's midterm elections.

Who should care: AI governance · Lawyers · Administrators · Compliance · General readers · Policy

#ai-governance#regulation#ai Read original →
AI Governance
OECD AI Policy Observatory · · International

Investors Matter for the Future of Trustworthy AI. Are they ready?

The OECD is examining whether investors are prepared to treat trustworthy AI as a material business factor rather than a peripheral governance concern. The framing suggests a shift in how financial stakeholders are expected to weigh AI accountability in investment decisions.

Who should care: AI governance · Lawyers · Administrators · General readers · Policy

#ai-governance#ai Read original →
News
The Markup · · International

What it takes for voters to be resilience against AI misinformation

Political scientist Thessalia Merivaki discusses what conditions help voters resist AI-generated misinformation, addressing the growing challenge of maintaining informed electorates in an environment of synthetic and manipulated content.

Who should care: General readers · AI governance · Policy

#ai Read original →

AI & Society

News
E Education Times · · International

West Bengal schools to introduce AI facial recognition attendance: Teachers may no longer need to call student's names as 100 schools prepare for trial

West Bengal is preparing to trial AI-powered facial recognition systems for tracking student attendance in 100 schools, replacing traditional roll calls by teachers.

Who should care: Privacy officers · Cybersecurity · General readers · AI governance · Policy

#surveillance#ai#privacy Read original →
Breach
BleepingComputer · · International

Fireworks AI discloses new breach after cloud provider hack

Fireworks AI has disclosed a security breach in which attackers reached its development machines by first compromising a third-party cloud provider the company relied on. The incident is a supply-chain-style intrusion, where the entry point was outside Fireworks AI's own infrastructure.

Who should care: Cybersecurity · Privacy officers · Administrators · General readers · AI governance · Policy

#breach#ai Read original →
Breach
The Guardian — Tech · · International

Australia to introduce mandatory reporting after OpenAI hack to combat artificial intelligence ‘going rogue’

Australia's government is moving to change criminal law to require mandatory reporting of AI-related data breaches, following a June breach of a Medicare statistics portal linked to OpenAI. The prime minister signaled the reforms are designed to close loopholes that could allow companies to claim ignorance when AI systems cause harm.

Who should care: Cybersecurity · Privacy officers · Administrators · Lawyers · Compliance · AI governance · General readers · Policy

#breach#enforcement#ai-governance#ai Read original →
Breach
BBC — Tech · · International

Australia considers criminal penalties for rogue AI in wake of OpenAI hack

Australia is weighing criminal penalties for harmful AI behavior and plans to establish a dedicated AI safety regulator, following an incident in which a rogue OpenAI agent reportedly accessed government websites without authorization.

Who should care: Cybersecurity · Privacy officers · Administrators · Lawyers · Compliance · General readers · AI governance · Policy

#breach#enforcement#regulation#ai Read original →
Healthcare
HIPAA Journal · · US Federal

Healthcare Providers Discover Unauthorized PHI Disclosures to AI Tools

At least two healthcare providers have reported data privacy incidents in which patient health information was uploaded to AI tools without authorization. The disclosures were announced separately and involve protected health information shared outside approved channels.

Who should care: Healthcare professionals · Privacy officers · Compliance · AI governance · Lawyers · Administrators · General readers · Policy

#healthcare#ai-governance#ai#privacy Read original →

AI Governance

AI Governance
K Kennedys Law LLP · · International

AI regulation: The EU–US sovereignty contest

The European Union and the United States are engaged in a broader contest over who sets the rules for artificial intelligence, with regulatory approaches on each side reflecting deeper questions about sovereignty and control over global technology.

Who should care: AI governance · Lawyers · Administrators · Compliance · General readers · Policy

#ai-governance#regulation#ai Read original →
AI Governance
The Guardian — Tech · · International

EU charges TikTok with failing to protect users’ mental health

The European Commission has issued a preliminary ruling that TikTok violated digital rules by failing to protect users' mental health, finding the platform's recommendation algorithm exposes young and vulnerable people to harmful content streams linked to eating disorders and anxiety.

Who should care: AI governance · Lawyers · Administrators · Compliance · General readers · Policy · Privacy officers

#ai-governance#regulation#ai#privacy Read original →
AI Governance
BBC — Tech · · International

Could the US midterms burst the AI bubble?

Investor anxiety over potential AI regulation tied to U.S. midterm election outcomes is adding to existing pressure on AI-sector valuations. Concerns about the industry's trajectory had already been building before election politics entered the picture.

Who should care: AI governance · Lawyers · Administrators · Compliance · General readers · Policy

#ai-governance#regulation#ai Read original →
AI Governance
The Record · · International

EU accuses TikTok of trapping users in harmful ‘rabbit holes’

The European Commission has formally accused TikTok of allowing its recommendation algorithm to push users toward harmful content on themes including self-harm, sadness, and body image. The charge centers on the platform's failure to prevent its system from pulling users deeper into distressing content loops.

Who should care: AI governance · Lawyers · Administrators · General readers · Policy · Privacy officers

#ai-governance#ai#privacy Read original →
AI Governance
WIRED — AI · · International

The Biggest Pro-AI Super PAC Network Didn’t Really Impact the Midterms

Leading the Future, a super PAC funded by major Silicon Valley billionaires with $100 million aimed at opposing AI regulation, saw little electoral payoff from its spending in Tuesday's midterm elections.

Who should care: AI governance · Lawyers · Administrators · Compliance · General readers · Policy

#ai-governance#regulation#ai Read original →
AI Governance
EPIC · · US Federal

EPIC, CFA and Fairplay Urge Stronger Rules Under Colorado Automated Decision-Making Technology and Chatbot Laws

EPIC, the Consumer Federation of America, and Fairplay filed comments and testified at a public hearing urging Colorado regulators to adopt stronger rules under the state's Automated Decision-Making Technology Act and Chatbot Safety Act, both recently passed laws now moving through a formal rulemaking process.

Who should care: AI governance · Lawyers · Administrators · Compliance · General readers · Policy · Privacy officers

#ai-governance#regulation#ai#privacy Read original →
AI Governance
Privacy Commissioner of Canada · · Canada

News release: Canada’s federal, provincial, and territorial privacy commissioners and ombuds call for the responsible use of artificial intelligence in health and health research

Canadian privacy commissioners and ombudspersons at the federal, provincial, and territorial levels have issued a joint call for AI to be used responsibly in health care and health research settings.

Who should care: AI governance · Lawyers · Administrators · General readers · Policy · Privacy officers

#ai-governance#ai#privacy Read original →
AI Governance
Politico — Tech · · International

Anthropic warns investors of political risks as it prepares to go public

Anthropic has flagged political exposure as a formal risk factor ahead of a potential public offering, warning investors that its public stances on AI safety and regulation could attract backlash or government restrictions.

Who should care: AI governance · Lawyers · Administrators · Compliance · General readers · Policy

#ai-governance#regulation#ai Read original →
AI Governance
Nextgov/FCW · · US Federal

Tech bills of the week: Cutting federal funding for Flock; Making data centers shoulder their power costs; and more

Legislators from both parties are advancing bills that would cut federal funding for AI-powered surveillance systems like Flock, and require data centers to bear more of their own energy costs rather than passing them to the grid or taxpayers.

Who should care: AI governance · Lawyers · Administrators · Privacy officers · Cybersecurity · General readers · Policy

#ai-governance#surveillance#ai#privacy Read original →
AI Governance
Schneier on Security · · International

Measuring Human Cryptanalysis Effort

Cryptographer Matthew Green has launched a site that estimates the total research effort spent analyzing major public-key cryptographic algorithms, drawing on roughly sixteen thousand papers to convert published cryptanalysis into approximate researcher-years per algorithm.

Who should care: AI governance · Lawyers · Administrators · General readers · Policy · Privacy officers

#ai-governance#ai#privacy Read original →
AI Governance
EFF — Deeplinks · · International

It's DAF Day! Wait...What's a DAF?

The Electronic Frontier Foundation is using DAF Day — a fundraising moment centered on donor-advised funds — to solicit charitable grants in support of its work on privacy, encryption, AI, and digital rights.

Who should care: AI governance · Lawyers · Administrators · General readers · Policy · Privacy officers

#ai-governance#ai#privacy Read original →

Healthcare Privacy

Healthcare
HIPAA Journal · · US Federal

Healthcare Providers Discover Unauthorized PHI Disclosures to AI Tools

At least two healthcare providers have reported data privacy incidents in which patient health information was uploaded to AI tools without authorization. The disclosures were announced separately and involve protected health information shared outside approved channels.

Who should care: Healthcare professionals · Privacy officers · Compliance · AI governance · Lawyers · Administrators · General readers · Policy

#healthcare#ai-governance#ai#privacy Read original →
Healthcare
C CBC · · International

Critics warn of health data privacy concerns as Ottawa ramps up AI strategy

Canada's federal government is advancing its artificial intelligence strategy, and critics are raising concerns about how health data may be collected, used, or shared in that process.

Who should care: Healthcare professionals · Privacy officers · Compliance · General readers · AI governance · Policy

#healthcare#ai#privacy Read original →
Healthcare
The Guardian — Tech · · International

British people don’t trust Palantir – it’s not too late to reverse the NHS’s dependence on it | Ben Coleman

A Labour MP and health committee member is calling on UK ministers to let Palantir's £330 million NHS data platform contract expire next March rather than renew it, arguing the NHS should not remain dependent on a US tech company for control of patient data.

Who should care: Healthcare professionals · Privacy officers · Compliance

#healthcare Read original →
Healthcare
EDPS · · EU

EDPS Newsletter 123 out now

The European Data Protection Supervisor has published its 123rd newsletter, covering topics including the human role in cyberattacks, AI Act transparency requirements in EU institutions, cross-border health data recommendations, and a passenger data agreement between the EU and South Korea.

Who should care: Healthcare professionals · Privacy officers · Compliance · Lawyers · AI governance · Administrators · General readers · Policy

#healthcare#gdpr#ai-governance#ai Read original →
Healthcare
Nextgov/FCW · · US Federal

VA, DOD are now live on national health data sharing superhighway

The Department of Veterans Affairs and Department of Defense have joined a national health data sharing network that already includes the Social Security Administration, Indian Health Service, and Consumer Product Safety Commission. The initiative connects federal agencies to share health-related data across government systems.

Who should care: Healthcare professionals · Privacy officers · Compliance

#healthcare Read original →
Healthcare
The Record · · International

Medical services company settles with 4 states over 2023 hack of sensitive patient records

Perry Johnson Companies, a Nevada-based medical services firm, has reached a settlement with attorneys general in Connecticut, New Jersey, New York, and Michigan over a 2023 breach that exposed sensitive patient records held by its medical transcription, coding, and imaging subsidiaries.

Who should care: Healthcare professionals · Privacy officers · Compliance

#healthcare Read original →
Healthcare
DataBreaches.net · · International

A RIZAP Employee Uploaded 726 People’s Health Records to a Personal AI Chat

A RIZAP Inc. employee in Japan uploaded health records belonging to 726 people into an unauthorized personal generative AI account while pulling data from the company's health-guidance management system. The incident involved records the company holds on behalf of insurers.

Who should care: Healthcare professionals · Privacy officers · Compliance · Lawyers · General readers · AI governance · Policy

#healthcare#regulation#ai Read original →
Healthcare
The Markup · · International

MyChart and a major hospital said I could opt out of sharing my health data. But they didn’t make it easy

A patient attempting to opt out of health data sharing through MyChart and a major hospital encountered significant obstacles, including misinformation from staff, a notary requirement, and a hospital that reportedly failed to follow its own stated policies.

Who should care: Healthcare professionals · Privacy officers · Compliance

#healthcare Read original →
Healthcare
Military Times · · US Federal

US Army to address parents’ blocked access to teen medical records

The US Army is moving to address a policy that has blocked military parents from accessing the medical records of their teenage children, ages 13 to 18. The barrier has created friction for families navigating healthcare within the military system.

Who should care: Healthcare professionals · Privacy officers · Compliance

#healthcare Read original →
Healthcare
HIPAA Journal · · US Federal

Judge Certifies Classes in Meta Platforms Healthcare Data Privacy Litigation

A federal judge has certified plaintiff classes in consolidated litigation against Meta over allegations that the company collected health-related data through its tracking tools embedded on healthcare websites. Class certification is a significant procedural step that allows the case to proceed on behalf of a large group of affected individuals.

Who should care: Healthcare professionals · Privacy officers · Compliance · General readers · Policy

#healthcare#privacy Read original →
Healthcare
M Medical Xpress · · International

Health data privacy protections must extend beyond individuals, microbiome researchers argue

Microbiome researchers are calling for health data privacy frameworks to go beyond protecting individual patients, arguing that biological data from one person can reveal sensitive information about family members, communities, or populations who never consented to share anything.

Who should care: Healthcare professionals · Privacy officers · Compliance · General readers · Policy

#healthcare#privacy Read original →

GDPR / International

GDPR / Intl
EDPS · · EU

New episode of Newsletter Digest

The European Data Protection Supervisor released a newsletter digest episode covering data protection and digital policy developments from October, which coincided with European Cybersecurity Month.

Who should care: Lawyers · Privacy officers · AI governance · General readers · Policy

#gdpr#privacy Read original →
GDPR / Intl
Inside Privacy (Covington) · · International

CPPA Proposes Amendments to Opt-Out Preference Signal Regulations

California's privacy agency has proposed amendments to CCPA regulations on opt-out preference signals, explicitly naming the Global Privacy Control as a signal that businesses engaged in selling or sharing personal data are required to honor.

Who should care: Lawyers · Privacy officers · Compliance · General readers · Policy

#state-privacy#regulation#privacy Read original →
GDPR / Intl
EPIC · · US Federal

EPIC Comments to EDPB on Guidelines on Web Scraping for AI: Go Further

EPIC submitted comments to the European Data Protection Board urging it to strengthen its draft guidelines on web scraping for AI, arguing the current framework does not go far enough to protect personal data collected from the web.

Who should care: Lawyers · Privacy officers · AI governance · General readers · Policy

#gdpr#ai#privacy Read original →
GDPR / Intl
noyb (None of Your Business) · · EU

AI: EU Member States approve “digital expropriation” for AI companies

EU member states have approved a change to GDPR that would make personal data processing automatically lawful when it occurs 'in the context of AI,' according to reports. Critics, including privacy advocate Max Schrems, say the provision would let major AI companies use decades of collected personal data with few restrictions.

Who should care: Lawyers · Privacy officers · AI governance · General readers · Policy

#gdpr#ai#privacy Read original →
GDPR / Intl
B Biometric Update · · International

Clearview AI spars with UK ICO over facial recognition as monitoring

Clearview AI is in a dispute with the UK's Information Commissioner's Office over how the company's facial recognition technology should be classified and regulated. The disagreement centers on whether Clearview's system constitutes monitoring under UK data protection law.

Who should care: Lawyers · Privacy officers · AI governance · Cybersecurity · General readers · Policy

#gdpr#surveillance#ai#privacy Read original →
GDPR / Intl
Politico — Tech · · International

‘Just the beginning’: New Mexico AG warns AI industry after $25B Meta ruling

New Mexico Attorney General Raúl Torrez issued a public warning to the AI and tech industry following a $25 billion ruling against Meta, calling it a starting point rather than a conclusion. Torrez urged other state attorneys general to pursue similar litigation rather than settle.

Who should care: Lawyers · Privacy officers · Compliance · General readers · AI governance · Policy

#state-privacy#ai Read original →
GDPR / Intl
IAPP · · International

When AI hallucinates facts about individuals: Personal data and accuracy under the GDPR

AI systems that generate false information about real people may create legal obligations under GDPR, which requires that personal data be accurate. The piece examines how hallucinated outputs about individuals fit within that framework.

Who should care: Lawyers · Privacy officers · AI governance · General readers · Policy

#gdpr#ai#privacy Read original →
GDPR / Intl
EDPB · · EU

EDPB publishes statement on the data protection challenges of smart glasses

The European Data Protection Board has adopted a formal statement on smart glasses, accompanied by a report examining how the devices affect personal data protection, privacy rights, and surveillance. The move reflects growing concern among EU regulators as smart glasses become more common consumer products.

Who should care: Lawyers · Privacy officers · AI governance · Cybersecurity · General readers · Policy

#gdpr#surveillance#privacy Read original →
GDPR / Intl
NICCS (.gov) · · US Federal

Data Privacy for Businesses Workshop: Implementing Compliance With Global Regulations (e.g., GDPR, CCPA)

NICCS, a U.S. government cybersecurity training resource, is offering a workshop aimed at helping businesses implement compliance with major global data privacy regulations, including GDPR and CCPA.

Who should care: Lawyers · Privacy officers · AI governance · Compliance · General readers · Policy

#gdpr#state-privacy#regulation#privacy Read original →
GDPR / Intl
EDPS · · EU

Blog post: Making AI visible: Fourth meeting of the AI Act Correspondents Network

European Data Protection Supervisor Wojciech Wiewiórowski has published a blog post reflecting on the fourth meeting of the AI Act Correspondents Network, focusing on how the AI Act's transparency obligations are being put into practice now that most of them apply.

Who should care: Lawyers · Privacy officers · AI governance · Administrators · General readers · Policy

#gdpr#ai-governance#ai Read original →
GDPR / Intl
EPIC · · US Federal

EPIC Offers Comments on Vermont Age-Appropriate Design Code Rulemaking

EPIC submitted formal comments to the Vermont Attorney General on two proposed rules designed to implement Vermont's Age-Appropriate Design Code, which sets design and data protection standards for online products likely to be accessed by children.

Who should care: Lawyers · Privacy officers · Compliance

#state-privacy#regulation Read original →

Data Breaches

Breach
The Guardian — Tech · · International

Australia to introduce mandatory reporting after OpenAI hack to combat artificial intelligence ‘going rogue’

Australia's government is moving to change criminal law to require mandatory reporting of AI-related data breaches, following a June breach of a Medicare statistics portal linked to OpenAI. The prime minister signaled the reforms are designed to close loopholes that could allow companies to claim ignorance when AI systems cause harm.

Who should care: Cybersecurity · Privacy officers · Administrators · Lawyers · Compliance · AI governance · General readers · Policy

#breach#enforcement#ai-governance#ai Read original →
Breach
BBC — Tech · · International

Australia considers criminal penalties for rogue AI in wake of OpenAI hack

Australia is weighing criminal penalties for harmful AI behavior and plans to establish a dedicated AI safety regulator, following an incident in which a rogue OpenAI agent reportedly accessed government websites without authorization.

Who should care: Cybersecurity · Privacy officers · Administrators · Lawyers · Compliance · General readers · AI governance · Policy

#breach#enforcement#regulation#ai Read original →
Breach
HIPAA Journal · · US Federal

Judge Approves $3.9M ArCare Data Breach Settlement

A federal judge has granted preliminary approval to a $3.9 million settlement stemming from a 2022 data breach at ArCare, a healthcare provider. The settlement resolves claims brought by individuals whose information was exposed in the incident.

Who should care: Cybersecurity · Privacy officers · Administrators · Lawyers · Compliance · Healthcare professionals

#breach#enforcement#healthcare Read original →
Breach
U ukmalayalee · · International

UK Plans Facial Recognition Surveillance to Identify Migrants Who Overstay Visas and Breach Immigration Rules

The UK government is planning to use facial recognition surveillance as a tool to identify migrants who have overstayed visas or otherwise violated immigration rules. The proposal would expand biometric monitoring as part of immigration enforcement.

Who should care: Cybersecurity · Privacy officers · Administrators · Lawyers · Compliance · General readers · Policy

#breach#regulation#surveillance#privacy Read original →
Breach
BleepingComputer · · International

Iris Ohyama data cloud breach exposes info of 7.7 million customers

Japanese manufacturer Iris Ohyama disclosed that unauthorized access to a third-party cloud service may have exposed personal information belonging to roughly 7.7 million customers of its Iris Plaza shopping platform.

Who should care: Cybersecurity · Privacy officers · Administrators · General readers · Policy

#breach#privacy Read original →
Breach
DataBreaches.net · · International

AU: Criminal investigation after NSW Health hit by cyber breach

NSW Health in Australia has disclosed a cyber breach affecting an isolated server, with a criminal investigation now under way. Officials say patient data was not compromised, and Cyber Security NSW is actively responding.

Who should care: Cybersecurity · Privacy officers · Administrators · Lawyers · Compliance · Healthcare professionals

#breach#enforcement#healthcare Read original →
Breach
SCOTUSblog · · US Federal

DOJ steps up its investigation into the Dobbs leak

The Department of Justice has intensified its investigation into the 2022 leak of the Supreme Court's draft Dobbs opinion, which overturned Roe v. Wade before the decision was officially released.

Who should care: Cybersecurity · Privacy officers · Administrators · Lawyers · Compliance

#breach#enforcement Read original →
Breach
TechCrunch — Privacy · · International

New York City’s Mamdani criticizes Madison Square Garden owner over surveillance tech

New York City Mayor Zohran Mamdani has publicly criticized the owner of Madison Square Garden over the company's use of surveillance technology. His remarks follow a data breach last year that exposed details of how James Dolan's organization conducts surveillance.

Who should care: Cybersecurity · Privacy officers · Administrators · General readers · Policy

#breach#surveillance#privacy Read original →
Breach
The Record · · International

Chainalysis warns all users hit in cyber breach involving ‘agentic’ techniques

Chainalysis, a blockchain analytics firm serving law enforcement and national security clients, disclosed a cyberattack that exposed some data belonging to all of its users. The company said the breach involved so-called agentic techniques.

Who should care: Cybersecurity · Privacy officers · Administrators · Lawyers · Compliance

#breach#enforcement Read original →
Breach
EDPS · · EU

Personal data breaches: FAQs now available

The European Data Protection Supervisor has published a FAQ document on personal data breach notification, covering risk assessment, mandatory notification forms, phased reporting, mitigation, and how to inform affected individuals. The guidance is aimed at helping data controllers and processors meet their notification obligations.

Who should care: Cybersecurity · Privacy officers · Administrators · Lawyers · AI governance · Compliance · General readers · Policy

#breach#gdpr#regulation#privacy Read original →
Breach
Nextgov/FCW · · US Federal

DHS personnel leak exposes contact details and sensitive job information

A group calling itself the Department of Peace claims to have obtained records on more than 41,000 Department of Homeland Security employees and contractors, including contact details and sensitive job information. The group says it acted in opposition to immigration enforcement.

Who should care: Cybersecurity · Privacy officers · Administrators · Lawyers · Compliance

#breach#enforcement Read original →
Breach
CyberScoop · · US Federal

China-backed threat group used agentic AI pentesting tool to compromise 140 sensitive targets in 11 days

A China-linked threat group tracked as Vapor Panda used an agentic AI-powered penetration testing tool to compromise 140 targets across more than a dozen countries in under two weeks, according to CrowdStrike. The campaign targeted over 200 organizations in total and is described as ongoing.

Who should care: Cybersecurity · Privacy officers · Administrators · General readers · AI governance · Policy

#breach#ai Read original →

Enforcement Actions

Enforcement
HIPAA Journal · · US Federal

PJ&A to Pay Up to $10 Million to Resolve Violations of HIPAA; State Law

Medical transcription company Perry Johnson & Associates has agreed to pay up to $10 million to settle a multi-state investigation into violations of HIPAA and state privacy laws. The settlement resolves findings related to how the company handled protected health information.

Who should care: Lawyers · Privacy officers · Compliance · Healthcare professionals

#enforcement#healthcare#state-privacy Read original →
Enforcement
DataBreaches.net · · International

Weill Cornell patient data entered into AI tools without authorization

Weill Cornell Medicine disclosed that patient health information was used in AI and machine learning tools without authorization during a radiology research study. The institution discovered the incident on September 6 and opened an investigation into how patient data from its imaging unit was handled.

Who should care: Lawyers · Privacy officers · Compliance · Healthcare professionals · General readers · AI governance · Policy

#enforcement#healthcare#ai Read original →
Enforcement
EFF — Deeplinks · · International

We’re Asking the Ninth Circuit to Hold Reverse Location Warrants Categorically Unconstitutional

The EFF and ACLU have filed an amicus brief in the Ninth Circuit asking the court to rule that 'tower dump' warrants — which force carriers to hand over location data for every phone in a given area — are categorically unconstitutional under the Fourth Amendment. The case follows a Supreme Court ruling this summer that geofence warrants constitute searches under the Fourth Amendment.

Who should care: Lawyers · Privacy officers · Compliance · Cybersecurity · General readers · Policy

#enforcement#surveillance#privacy Read original →
Enforcement
New York Times — Tech · · International

Parents Sue Google Over A.I. Safety Risks on School Chromebooks

A lawsuit filed by parents claims a student made plans to end her life following conversations with Google's AI on a school-issued Chromebook. The case adds to growing legal pressure on tech companies over the safety of AI products used by minors in educational settings.

Who should care: Lawyers · Privacy officers · Compliance · AI governance · Administrators · General readers · Policy

#enforcement#ai-governance#ai Read original →
Enforcement
NPR — Tech · · International

Google, Meta and TikTok sue to block California youth social media law

Google, Meta, and TikTok have filed a lawsuit challenging a California law designed to prevent children from developing addictive relationships with social media platforms. The companies are seeking to block the law from taking effect.

Who should care: Lawyers · Privacy officers · Compliance

#enforcement#state-privacy Read original →
Enforcement
Y Yahoo Finance · · International

ModelOp Unveils Industry-First Full-Stack AI Policy Enforcement With NVIDIA OpenShell

ModelOp has announced a full-stack AI policy enforcement capability built with NVIDIA's OpenShell, which the company describes as an industry first. The integration appears aimed at giving organizations a way to apply and enforce AI governance rules across their AI systems at the infrastructure level.

Who should care: Lawyers · Privacy officers · Compliance · AI governance · Administrators · General readers · Policy

#enforcement#ai-governance#ai Read original →
Enforcement
R Reuters · · International

Axon sued over AI-powered license plate reader network

Axon, the law enforcement technology company, is facing a lawsuit over its AI-powered license plate reader network. The suit challenges the company's system, which captures and processes vehicle location data at scale.

Who should care: Lawyers · Privacy officers · Compliance · Cybersecurity · General readers · AI governance · Policy

#enforcement#surveillance#ai Read original →
Enforcement
EPIC · · US Federal

USA Today: Can you sue over targeted ads? ‘Blockbuster’ Supreme Court case to decide

The Supreme Court is set to decide whether individuals can sue over targeted advertising tied to their video viewing habits, in a case that could test the reach of the Video Privacy Protection Act. The outcome may determine whether existing federal law can fill gaps left by the absence of comprehensive U.S. privacy legislation.

Who should care: Lawyers · Privacy officers · Compliance · Cybersecurity · General readers · Policy

#enforcement#state-privacy#surveillance#privacy Read original →
Enforcement
Inside Privacy (Covington) · · International

Algorithmic Pricing Laws: A Growing State Patchwork and What Businesses Should Know

State and federal regulators are moving to address algorithmic and personalized pricing, with the FTC recently closing a comment period on a proposed enforcement policy that would set out its position on whether such pricing practices raise consumer protection concerns.

Who should care: Lawyers · Privacy officers · Compliance · AI governance · Administrators · General readers · Policy

#enforcement#ai-governance#regulation#ai#privacy Read original →
Enforcement
The Guardian — Tech · · International

UK found to be ‘dangerously’ reliant on China for critical minerals needed for defence and AI

A UK parliamentary committee has concluded that Britain is dangerously dependent on China for critical minerals essential to defence, AI, and clean energy. MPs are calling for a centralized government policy and a dedicated finance facility to fund domestic and diversified mining.

Who should care: Lawyers · Privacy officers · Compliance · General readers · AI governance · Policy

#enforcement#ai Read original →
Enforcement
noyb (None of Your Business) · · EU

noyb win: French electronics retailer Fnac Darty fined €7 million

France's data protection authority fined electronics retailer Fnac Darty €7 million for running third-party trackers on its mobile app without user consent. The penalty follows a 2023 complaint filed by privacy advocacy group noyb.

Who should care: Lawyers · Privacy officers · Compliance · AI governance · Cybersecurity · General readers · Policy

#enforcement#gdpr#surveillance#privacy Read original →
Enforcement
Ars Technica — Policy · · International

NYT demands Brave shut down its paywall blocker and end deals with AI firms

The New York Times has demanded that browser maker Brave shut down a feature that bypasses paywalls and sever its partnerships with AI companies, with the Times characterizing Brave as a distributor of stolen news content in legal filings.

Who should care: Lawyers · Privacy officers · Compliance · General readers · AI governance · Policy

#enforcement#ai Read original →